Qualys' Third Quarter 2026 Investor Call - QUALYS INC

Explicit Guidance:

• Full Year 2026 Revenue: $736.9–$738.9 million (10% growth); upgraded from prior guidance of $732–$738 million.
• Q4 2026 Revenue: $191–$193 million (9–10% growth).
• Full Year 2026 EBITDA Margin: 46%.
• Full Year 2026 Operating Expenses: Expected to increase in the low double-digits.
• Full Year 2026 Free Cash Flow Margin: Low 40s.
• Full Year 2026 EPS: $8.07–$8.14; upgraded from prior guidance of $7.74–$7.88.
• Q4 2026 EPS: $2.05–$2.12.
• Full Year 2026 Capital Expenditures: $9.5–$11.5 million.
• Q4 2026 Capital Expenditures: $2.3–$4.3 million.
• Share Repurchases: $53.6 million used in Q3; $176.1 million remaining in the program as of quarter-end.
• Calculated Current Billings (Q4): Expected to be approximately 8% (base case), despite Q1–Q3 performance of 16% and 14%.
• Calculated Current Billings (Full Year 2026): 11% growth.

Business-Segment Outlook:

• Product Adoption: Expect continued shift toward higher-value solutions (ETM, CSAM, Patch Management/TrueRisk Eliminate). ETM and CSAM combined represented 12% of total bookings and 14% of new bookings in Q3, up from 10% and 11% respectively.
• Patching & Remediation: Anticipate continued acceleration in patch deployments (up 47% since April) and autonomous deployments; aiming to deploy TrueRisk Eliminate 2.0 capabilities to increase autonomous patching beyond current 60% levels.
• QFlex: Expect the QFlex model to drive higher utilization and larger upsells by removing friction in module prediction; observed 20%+ increase in average annual bookings for customers transitioning to QFlex.
• Customer Cohorts: Number of customers spending $500k+ grew 15% YoY to 243; focus on expanding this cohort through deeper platform adoption (ETM + TrueRisk Eliminate).
• Federal Vertical: Project continued strength in federal/state/local government business driven by new operational mandates (e.g., CISA BOF 2604) requiring rapid risk-based remediation; expects this vertical to remain a key growth driver, though deals may remain lumpy.
• International Growth: Expects sustained double-digit growth outside the U.S. (50% growth in Q3 vs. 7% domestic), driven by partner ecosystem and evolving vulnerability management paradigms.

Market and Competitive Outlook:

• Market Demand: Shift in customer evaluation from "detection" to "autonomous remediation" and "proof of closure" due to AI-powered adversaries increasing vulnerability exposure 15-fold.
• Competitive Landscape: Anticipate increased focus on solutions that integrate detection, validation, and remediation in a single loop; competitors offering disjointed tools (scanning, prioritization, patching) face disadvantage against Qualys' native "AI-native ROC."
• Sales Motion: Expect longer sales cycles for organizational transformation but accelerating conversion for customers aligning IT and security teams; target moving from 0% automation to higher autonomous remediation percentages over coming quarters.
• Vulnerability Volume: Expect sustained high volume of new CVEs (e.g., 1,414 in a single Microsoft release) necessitating faster, AI-driven response rather than manual processing.

Macro / Industry Outlook:

• Regulatory Impact: CISA BOF 2604 requiring remediation within 72 hours is a primary catalyst for demand; organizations must operationalize risk-based remediation to comply.
• Cybersecurity Paradigm: Industry shifting from reactive SOC (post-breach) to proactive ROC (pre-breach); security budgets expected to gradually move from detection/response to proactive risk management and autonomous remediation capabilities.
• Adoption Timeline: No "knee-jerk" purchasing reaction expected immediately following specific vulnerability events (e.g., PHP to Shell); instead, customers undergoing internal structural changes (IT/Security alignment) over quarters to years.

Strategic Initiatives:

• Product Launches: Continued evolution of "TrueRisk Eliminate 2.0 with TrueConfidence," including AI-powered patch reliability scores, wave-based remediation, peer-to-peer patching, and AI-guided rollbacks.
• Platform Expansion: Extending TrueConfidence coverage beyond endpoints to cloud applications, perimeter assets, and air-gapped infrastructure (routers, switches, firewalls).
• Ecosystem Integration: Strengthening multi-vendor architecture with new integrations for mobile, IoT, and OT systems; leveraging partners like Dynatrace for post-deployment operational resiliency monitoring.
• M&A/Partnerships: No specific M&A guidance provided; focus is on expanding strategic alliances with Managed Security Service Providers (MSSPs) and Managed Risk Operations Providers (MROPs) to guide customer transformation.
• Capacity/Operations: Investing in AI-native infrastructure to support real-time detection (<60 minutes from disclosure) and autonomous validation (9 million+ validations to date).

Risks and Headwinds to Outlook:

• Pipeline Volatility: Federal and large new logo deals can be lumpy; Q4 billings guidance (8%) reflects a base case rather than assuming continued Q2/Q3 outperformance.
• Sales Cycle Length: No material compression in sales cycles expected; organizational alignment between IT and Security teams required for implementation can delay close timing.
• Revenue Recognition Linearity: Timing of deal closures (especially new logos closing near quarter-end) can impact revenue linearity and beat/miss profiles relative to billings.
• Adoption Friction: Lack of operational confidence remains a blocker; customers require time to validate AI-driven remediation and align internal processes before full-scale adoption.
• Macro Economic Sensitivity: While not explicitly detailed, reliance on partner ecosystems and large enterprise transformations implies potential sensitivity to broader IT budget constraints.

Management Tone on the Future:

• Confidence: High confidence in "durable long-term growth" driven by the operationalization of the AI-native ROC; view the current market shift as a structural inflection point rather than temporary noise.
• Caveats: Explicitly noted that while Q1–Q3 billings were strong (16%, 14%), Q4 is expected to be "lumpy" with a base case of 8%; no immediate acceleration in revenue growth assumed for the short term despite strong booking trends.
• Strategic Shift: Management emphasizes a "no look back" commitment to autonomous remediation, viewing traditional vulnerability management models as "indefensible" against AI adversaries.

Miscellaneous:

• Channel Contribution: Channel partners now represent 55% of total revenue (up from 50%); channel revenue grew 24% YoY vs. 2% decline in direct.
• Net Dollar Expansion Rate: Overall NDR held steady at 105%; ETM/CSAM cohort NDR improved to 108%.
• Operational Metrics: 180 million patches deployed in last 12 months; 60% autonomous (up from 30%); rollback rate <1 in 8,000.
• Analyst Ratings: Qualys received highest ratings in Forrester Wave (Proactive Security) and Kupfer Compass (Attack Surface Management) for 2026.